Store audit events for long-term retention - ActionTrail

ActionTrail retains events for the past 90 days by default. To meet compliance requirements such as MLPS 2.0 (180+ days), create a trail and a data backfill task to store complete events in Simple Log Service (SLS). Otherwise, events older than 90 days cannot be retrieved.

Prerequisites

Simple Log Service (SLS) is activated.

When you first use SLS, log on to the Simple Log Service console and activate the service as prompted. For more information, see What is Simple Log Service?.
You need permission to use data backfill. To obtain it, submit a ticket.

Background information

A trail delivers only events generated after its creation. To capture the full 90-day history, also create a data backfill task to deliver events from before the trail was created.

A data backfill task covers the period from 90 days before the current time to 5 minutes after the trail was activated. For example, if Trail A was created 40 days ago, the backfill task covers the 50-day period before Trail A was created.

Note

Data backfill tasks deliver events from single-account trails to SLS only.
Only one data backfill task can run at a time per Alibaba Cloud account.

Step 1: Create a single-account trail to SLS

Log on to the ActionTrail console.
In the left-side navigation pane, click Trails.
In the top navigation bar, select the region for the trail.

Note
This region becomes the home region of the single-account trail.
On the Trails page, click Create Trail.

On the Create Trail page, configure the trail.

In the Basic Information section, set the trail name and the management event type.
Note
By default, the trail applies to all regions. We recommend that you set Management Event to All Events to capture all events from all regions. For more information about the parameters, see Create a single-account trail.

In the Event Delivery section, configure event delivery to SLS in the current account.

Parameter

Description

Logstore Region

The region of the SLS project.

Project Name

The name of the SLS project.

Note

Project names must be globally unique within Alibaba Cloud.

If you select New Log Service Project, create a project and specify its name.
If you select Existing Log Service Project, select an existing project from the drop-down list.

To create an SLS project, follow Collect and analyze ECS text logs by using LoongCollector.

Click Confirm.

Step 2: Create a data backfill task

In the left-side navigation pane, click Backfill.
In the top navigation bar, select the region for the data backfill task.

Note
This region must match the home region of the trail.
On the Backfill page, click Create Task.
On the Create Task page, select the trail.

Note
After you select a trail, the system automatically populates the region, project, and Logstore fields.
Click Confirm.

After the task is created, check its Delivery Status on the Backfill page to verify event delivery.

Step 3 (Optional): Query complete events

In the left-side navigation pane, click Trails.
In the top navigation bar, select the trail region.
On the Trails page, find the target trail. In the Storage Service column, hover over SLS or SLS&OSS and click the name of the SLS Logstore.
Click Last 15 Minutes and specify a time range for your query.
Enter an SQL statement and click Search & Analyze to query the event details.

References

Query and analyze event details with Quick start for log query and analysis.
SQL query examples: Use SQL statements to query ActionTrail events in SLS.
Troubleshoot query issues: FAQ about log query and analysis.